Image forming apparatus and print controlling method for prohibiting copying of copied documents with an image

ABSTRACT

A copier that includes a reading unit to read a document to obtain an image and a printing unit configured to print the obtained image to obtain a copied document. The copier further includes a setting unit to set a setting for adding an image indicating that copying the copied document is inhibited and a controlling unit to control the printing unit so in a case where a document having an image indicating that copying the document is permitted subject to an input of authentication information is read to obtain an image and the setting is not set, the obtained image is printed subject to an input of the authentication information, and in a case where a document having an image indicating that copying the document is permitted subject to an input of authentication information is read to obtain an image and the setting is set, not printed the image.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.13/325,192 filed Dec. 14, 2011, which claims priority from U.S. patentapplication Ser. No. 12/167,043 filed Jul. 2, 2008, which claimspriority from Japanese Patent Application No. 2007-177634 filed on Jul.5, 2007, all of which are hereby incorporated by reference herein theirentirety.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to an image forming apparatus that printsa document image according to a print instruction and a printcontrolling method for the same.

2. Description of the Related Art

With promotion of information technology (IT) in offices, interest forsecurity has been rising recently. For example, as seen in repeatedlycaused leakage of client information held by companies, confidentialinformation of organizations and privacy of individuals are threatened,which has become a big social issue.

To cope with such an issue, an IT mechanism for providing an accessright to electronic confidential information or a monitoring apparatusat firewall is introduced to prevent the confidential information frombeing leaked to outside of the companies. Alternatively, measures ofprohibiting portable media, such as a notebook personal computer (PC)and a universal serial bus (USB) flash memory, from being carried in orout are taken.

By taking the above-described measures using the IT mechanism, theelectronic confidential information can be protected to some extent.This is because the electronic information can be referred to only usingthe IT and it is easier to introduce the IT mechanism thereto.

On the other hand, when confidential information is printed on papermedia with an image forming apparatus or the like, carrying out of asheet having confidential information of organizations or privateinformation of individuals printed thereon can escape theabove-described IT mechanism. Accordingly, it is more difficult toconfirm and prohibit such a sheet from being carried out than torestrict electronic confidential information from being carried out,which makes it difficult to maintain the security.

To cope with such an issue, various measures for information leakagehave been considered. As a first measure for information leakage, asystem that embeds tracking information on paper media in addition to amain image using known information embedding techniques, such as thedigital watermarking and the 2-dimensional barcode, at the time ofprinting has been suggested.

Even if information leakage involving paper media occurs, this systemcan extract the above-described tracking information by analyzing theleaked document. Accordingly, since the responsibility for carelesscarrying out of a document can be investigated using the trackinginformation, a deterrent effect can be expected.

Furthermore, as a second measure for information leakage, a system forembedding copy restriction information for prohibiting copying in papermedia using known information embedding techniques, such as the digitalwatermarking and the 2-dimensional barcode, at the time of printing hasbeen suggested.

In this system, a compatible image forming apparatus extracts theabove-described copy restriction information to detect whether copyingis permitted at the time of execution of a copy operation, thereby beingable to control continuance or cancellation of the copy operation foreach page.

A system for embedding, as condition information, password informationand permitted user information as well as copy restriction informationsimply indicating whether copying is permitted and for permitting onlyspecific users to copy a document has been suggested. For example,Japanese Patent Laid-Open No. 2003-280469 disclosing a system of thiskind is known. Hereinafter, the above-described tracking information andcopy restriction information are collectively referred to as “additionalsecurity information”.

In the related art, such additional security information can beunconditionally embedded regardless of whether additional securityinformation has previously been embedded in a document.

However, when a plurality of pieces of additional security informationis embedded in a document, an image forming apparatus according to therelated art may be unable to extract the additional security informationdue to interference of the plurality of pieces of additional securityinformation.

SUMMARY OF THE INVENTION

An image forming apparatus according to an aspect of the presentinvention includes: a combining unit configured to combine a documentimage and a coded image; a setting determining unit configured todetermine whether a setting for combining a document image including apreviously combined coded image and an other coded image is made when areproduction of the document image is instructed; and a prohibiting unitconfigured to prohibit the combining unit from combining the documentimage including the previously combined coded image and the other codedimage according to the setting when the result of the determinationindicates that the setting is made.

Further features and aspects of the present invention will becomeapparent from the following description of exemplary embodiments withreference to the attached drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagram showing an overall arrangement of a network printingsystem in accordance with a first exemplary embodiment of the presentinvention.

FIG. 2 is a diagram showing an example of a printed output including abackground image containing copy prohibition information orprinted-output tracking information embedded therein.

FIG. 3 is a diagram showing a functional configuration of a networkprinting system when an implementation method for allowing a client PCto generate a background image of a printed output is employed.

FIG. 4 is a diagram showing a functional configuration of a networkprinting system when an implementation method for allowing an imageforming apparatus to generate a background image of a printed output isemployed.

FIG. 5 is a diagram showing one of printer driver setting screensemployed in a client personal computer (PC) 111 or 112.

FIG. 6 is a diagram showing a screen displayed when an image formingapparatus cancels a copy operation upon detecting inclusion of copyprohibition information in a document.

FIG. 7 is a diagram showing another screen displayed when an imageforming apparatus suspends a copy operation upon detecting inclusion ofcopy prohibition information in a document.

FIG. 8 is a diagram showing appearance of an image forming apparatus 131or 132.

FIG. 9 is a graphical user interface (GUI) showing a general copy screendisplayed in an image forming apparatus.

FIG. 10 is a GUI showing an application mode dialog 2901 displayed inresponse to pressing of an application mode button 2805.

FIG. 11 is a GUI showing an information embedding setting dialog 3001displayed in response to pressing of an information embedding button2904.

FIG. 12 is a GUI showing copy prohibition setting dialog 3101 displayedin response to pressing of a copy prohibition setting button 3002.

FIG. 13 is a GUI showing a tracking information setting dialog 3201displayed in response to pressing of a tracking information settingbutton 3003.

FIG. 14 is a diagram showing a functional configuration of an imageforming apparatus when a background of a printed output includes copyprohibition information at the time of copying of a paper document.

FIG. 15 is a GUI showing an administrator setting dialog 3301.

FIG. 16 is a diagram showing a functional configuration of an imageforming apparatus when a copy restriction operation is performed.

FIG. 17 is a table showing characteristic differences between a firstarea and a second area.

FIG. 18 is a schematic diagram showing a layout of first areas andsecond areas when information is embedded in a sheet.

FIG. 19 is a diagram showing an example of embedding binary data“010111110011” as additional security information.

FIG. 20 is a block diagram showing a configuration of a data analyzingsection 312 that analyzes LVBC.

FIG. 21 is a diagram showing a dot detection operation performed by adot detecting unit 1302.

FIG. 22 is a graph for illustrating removal of halftone.

FIG. 23 is a schematic diagram showing a method of measuring a gridinterval.

FIG. 24 is a histogram showing an example of frequencies of inter-griddistances.

FIGS. 25A to 25D are diagrams showing correction of a grid rotationangle.

FIGS. 26A and 26B are diagrams showing a rotation correction result anda determined grid position.

FIG. 27 is a diagram showing conversion of grid displacement into actualdata.

FIG. 28 is a graph showing an example of calculating an autocorrelationvalue for an offset value.

FIG. 29 is a schematic diagram showing a method of deciding a positionof a first area.

FIG. 30 is a schematic diagram showing totalization of first areas.

FIG. 31 is a diagram showing a decryption process including errorcorrection performed in consideration with rotation.

FIG. 32 is a graph showing an example of calculating an autocorrelationvalue for an offset value in a second area.

FIG. 33 is a schematic diagram showing a method of deciding a startposition of a second area.

FIGS. 34A and 34B are diagrams illustrating double-embedding ofadditional security information in a copy job.

FIGS. 35A and 35B are diagrams illustrating double-embedding ofadditional security information in a print job as in the case of a copyjob.

FIG. 36 is a flowchart showing a procedure of an operation performed bya job control determining section 903.

FIG. 37 is a flowchart showing a procedure of an operation performed bya job control determining section 903 following the flowchart of FIG.36.

FIG. 38 is a flowchart showing a procedure of an operation performed bya job control determining section 903 when whether printing is permittedis decided according to an administrator setting in accordance with asecond exemplary embodiment of the present invention.

FIG. 39 is a flowchart showing a procedure of an operation performed bya job control determining section 903 when whether printing is permittedis decided according to an administrator setting following a flowchartof FIG. 38.

FIG. 40 is a GUI showing a double-embedding prevention setting dialog3701 displayed in response to pressing of a double-embedding preventionbutton 3305 on an administrator setting dialog (see FIG. 15).

FIG. 41 is a diagram showing a functional configuration of an imageforming apparatus for realizing operations of “ignore” and “cancel”.

FIG. 42 is a flowchart showing a procedure of an operation performed bya job control determining section 903 when whether printing is permittedis decided according to a result of comparison of contents of additionalsecurity information in accordance with a third exemplary embodiment ofthe present invention.

FIG. 43 is a flowchart showing a procedure of an operation performed bya job control determining section 903 when whether printing is permittedis decided according to a result of comparison of contents of additionalsecurity information following a flowchart of FIG. 42.

FIG. 44 is a GUI showing a double-embedding prevention setting dialog4001 displayed in response to pressing of a double-embedding preventionbutton 3305 on an administrator setting dialog (see FIG. 15).

FIG. 45 is a diagram showing a functional configuration of an client PCand an image forming apparatus when a copy restriction operation isperformed in accordance with a fourth exemplary embodiment of thepresent invention.

FIG. 46 is a flowchart showing a procedure of an operation performed bya job control determining section 903 during a print job.

FIG. 47 is a flowchart showing a procedure of an operation performed bya job control determining section 903 according to an administratorsetting in accordance with a fifth exemplary embodiment of the presentinvention.

FIG. 48 is a flowchart showing a procedure of an operation performed bya job control determining section 903 according to an administratorsetting following a flowchart of FIG. 47.

FIG. 49 is a flowchart showing a procedure of an operation performed bya job control determining section 903 according to a result ofcomparison of contents of additional security information.

FIG. 50 is a flowchart showing a procedure of an operation performed bya job control determining section 903 according to a result ofcomparison of contents of additional security information following aflowchart of FIG. 49.

DESCRIPTION OF THE EMBODIMENTS

An image forming apparatus according to exemplary embodiments of thepresent invention, a print controlling method for the same, an imageforming system, a program, and a storage medium will be described withreference to the attached drawings. The image forming apparatusaccording to the exemplary embodiments can be applied to a networkprinting system.

First Exemplary Embodiment Overall Arrangement of System

FIG. 1 is a diagram showing an overall arrangement of a network printingsystem according to a first exemplary embodiment of the presentinvention. The network printing system includes client personalcomputers (PC) 111 and 112, a print server 121, and image formingapparatuses 131 and 132 having a copy function and a printer function.These apparatuses are connected to each other via a local area network(LAN) 101 and have a function to communicate with each other via the LAN101.

In response to a user operation of the client PC 111 or 112(corresponding to an image processing apparatus), the client PC 111 or112 generates print data and sends the print data to the print server121. The print server 121 further sends the received print data to theimage forming apparatus 131 or 132. The image forming apparatus 131 or132 interprets and converts the received print data into an image andprints the image on a piece of paper to create a printed material.

The above-described configuration is only an example and the printserver 121 may be omitted. In that case, the client PC 111 or 112directly sends the print data to the image forming apparatus 131 or 132.At this time, the apparatuses may be connected to each other using aknown local interface, such as IEEE 1284 or a universal serial bus(USB), instead of the LAN 101.

[Instruction of Embedding Copy Restriction Information or Printed-OutputTracking Information and Copy Restriction Operation]

An operation of the entire system will be briefly described first.Referring to the configuration shown in FIG. 1, a user operates theclient PC 111 or 112 to instruct embedding of copy prohibitioninformation or printed-output tracking information in a printed output.In response to this instruction, the image forming apparatus 131 or 132embeds the copy prohibition information or the printed-output trackinginformation in a created printed output as a background image. FIG. 2 isa diagram showing an example of a printed output including a backgroundimage having the copy prohibition information or the printed-outputtracking information embedded therein. A detailed description regardingFIG. 2 will be given later. In addition, a specific operation from auser's operation to creation of a printed output will be described laterwith reference to FIGS. 3 and 4. FIG. 3 is a diagram showing afunctional configuration of a network printing system when animplementation method for allowing a client PC to generate a backgroundimage of a printed output is employed. FIG. 4 is a diagram showing afunctional configuration of a network printing system when animplementation method for allowing an image forming apparatus togenerate a background image of a printed output is employed.

As shown in FIG. 2, when a user attempts to copy a document includingcopy restriction information using the image forming apparatus 131 or132, the image forming apparatus 131 or 132 detects inclusion of thecopy restriction information in the document and cancels the copyoperation. This prevents important document from being copied.

Although the operation of the entire system has been briefly describedin the above, a series of these operations will be described morespecifically.

[Specification of Copy Control Information or Tracking Information inClient PC]

FIG. 5 is a diagram showing one of printer driver setting screensemployed in the client PC 111 or 112. A user performs operations on aprint security setting dialog 501 to select security settings to beembedded in a printed output. The print security setting dialog 501 ismainly divided into two parts. The upper half is a part where a copyrestriction setting is made, whereas the lower half is a part where atracking information setting is made.

The upper half part where the copy restriction setting is made will bedescribed first. In this exemplary embodiment, a user operates radiobuttons 502 to select one of three setting options of “permit copying”,“(always) prohibit copying”, and “set copy permitting conditions (cancelcopy prohibition in response to input of a password)”. If the thirdoption “cancel copy prohibition in response to input of a password” isselected, a password input field 503 is activated to receive the inputand a user can input a password for canceling copy prohibition.

The lower half part of the print security setting dialog 501 where thetracking information setting is made will now be described. In thisexemplary embodiment, two checkboxes 504 and 505 are provided. A userchecks the checkboxes 504 and 505, thereby instructing embedding of auser name and time information, respectively.

Although these two kinds of tracking information have been shown in thisexemplary embodiment, any give kinds of tracking information can beincluded as long as the information is held in the image formingapparatus. For example, an internet protocol (IP) address and a mediaaccess control (MAC) address of the image forming apparatus 131 and adivision name of an installed place or an office may be attached as thetracking information.

The above-described various kinds of information are stored in a jobrestriction information storage section 304 (see FIG. 3) in response toa user's pressing of an OK button 506.

[Copy Restriction Operation in Image Forming Apparatus]

An example screen displayed upon the image forming apparatus 131 or 132detecting inclusion of copy restriction information in a document willnow be described. This screen is displayed on an operation unit 812 (seeFIG. 8).

FIG. 6 is a diagram showing a screen displayed when an image formingapparatus cancels a copy operation upon detecting inclusion of copyprohibition information in a document. FIG. 7 is a diagram showinganother screen displayed when an image forming apparatus suspends a copyoperation upon detecting inclusion of copy prohibition information.

FIG. 6 shows an example screen displayed when the image formingapparatus cancels the copy operation upon detecting the copy prohibitioninformation of “always prohibit copying”, among the three copyconditions shown in FIG. 5, embedded in a document. An operation screen601 displays a message dialog 602 informing cancellation of a copyoperation.

FIG. 7 shows a screen displayed when the image forming apparatussuspends the copy operation upon detecting the copy prohibitioninformation of “cancel copy prohibition in response to input of apassword”, among the three copy conditions shown in FIG. 5, embedded ina document. An operation screen 601 displays an authorization dialog 702for prompting a user to input the password. In response to a user'sinput of the password using a soft keyboard or an IC card (not shown),the image forming apparatus determines whether the input passwordmatches a password included in the background image of the document. Ifthe passwords match, the image forming apparatus closes theauthorization dialog 702 and continues the copy operation. On the otherhand, if the input of the password fails, the image forming apparatuscancels the copy operation.

[Appearance of Image Forming Apparatus]

FIG. 8 is a diagram showing appearance of the image forming apparatus131 or 132. A scanner unit 813 exposes/scans an image on a document andinputs the reflected light to a light-sensitive element, such as acharge coupled device (CCD) or a contact image sensor (CIS), therebyconverting image information into an electric signal. Furthermore, thescanner unit 813 converts the electric signal into luminance signals ofR, G, and B, and outputs these luminance signals as image data.

A document is set at a tray 802 of a document feeder 801. In response toa user's instruction of starting scanning entered using the operationunit 812, the scanner unit 813 receives a document scanning instruction.Upon receiving this instruction, the scanner unit 813 scans eachdocument fed from the tray 802 of the document feeder 801. Meanwhile, asa document scanning method, a method of scanning the document mounted ona glass surface (not shown) by moving an exposure unit may be employedinstead of an auto feeding method using the document feeder 801.

A printer unit 814 is an image forming device that forms an image of theimage data on a piece of paper. Although an electrophotographic systemusing a photosensitive drum and a photosensitive belt is employed as animage forming method in this exemplary embodiment, the image formingmethod is obviously not limited to this method. For example, the imageforming method may be an inkjet method for discharging ink from a smallnozzle array and printing an image onto a sheet. In addition, theprinter unit 814 is equipped with a plurality of sheet cassettes 803,804, and 805 that allow different sheet sizes and different sheetdirections to be selected. A printed sheet is discharged at a dischargetray 806.

[Operation for Creating Printed Output Including Additional SecurityInformation]

An operation for creating a printed output including additional securityinformation will now be described in detail with reference to FIGS. 3and 4. As described above, there are two methods, a method for allowinga client PC to generate a background image of a printed output (see FIG.3) and a method for allowing an image forming apparatus to generate thebackground image (see FIG. 4). FIGS. 3 and 4 show a flow of dataprocessing performed in the client PC and the image forming apparatus.Accordingly, functional elements shown in each block of FIGS. 3 and 4 donot necessarily have one-to-one correspondence with physical elements ofthe client PC and the image forming apparatus.

As described above, FIG. 3 shows a functional configuration of a networkprinting system when an implementation method for allowing a client PCto generate a background image of a printed output is employed. Theclient PC 111 has a print data generating section 301, an imagecombining section 302, a data sending section 303, a job restrictioninformation storage section 304, and a meta information image generatingsection 305. On the other hand, the image forming apparatus 131 has adata receiving section 311, a data analyzing section 312, an imagegenerating section 313, and a printing section 314.

A user performs a print instructing operation in the client PC 111,whereby the print data generating section 301 is activated. The printdata generating section 301 is realized by a print subsystem in which aprinter driver operates in cooperation with an operating system (OS).

The print data generating section 301 converts a document that a userhas instructed to print into a group of drawing instructions to be givento the image forming apparatus to generate print data. Morespecifically, this conversion is realized by generating, for example,the page description language (PDL). The print data generating section301 sends the generated print data to the image combining section 302.

The job restriction information storage section 304 sends jobrestriction information, held therein as a result of a user operationperformed on the security setting dialog shown in FIG. 5, to the metainformation image generating section 305.

The meta information image generating section 305 generates a backgroundimage including copy restriction information and tracking informationbased on the job restriction information received from the jobrestriction information storage section 304. There is a method using,for example, low visibility barcode (LVBC) as a method for generatingthis background image. The LVBC will be described later. The metainformation image generating section 305 sends the generated backgroundimage to the image combining section 302.

The image combining section 302 combines the print data received fromthe print data generating section 301 and the background image receivedfrom the meta information image generating section 305 to create aninstruction to be given to the image forming apparatus so that thebackground image is included in each page of the print data. Morespecifically, there is a method for embedding the background image inthe PDL as overlay form information. The image combining section 302sends the combined print data to the data sending section 303.

The data sending section 303 sends the combined print data to the printserver 121 or the image forming apparatus 131 or 132. Since FIG. 3 showsthe logical data flow, the illustration of the print server 121 isomitted in FIG. 3 even if the print server 121 exists therebetween.

On the other hand, in the image forming apparatus, the data receivingsection 311 waits for data sent via the LAN 101. Upon detectingtransmission of data from another node in the LAN, the data receivingsection 311 transfers the received data to an appropriate subsystemaccording to the type of the data. The type of data is generallyidentified by the port number when transmission controlprotocol/internet protocol (TCP/IP) is employed as the communicationprotocol, for example. The port number 515 used in the line printerdaemon (lpr) and the port number 9100 used in the raw are known as ageneral port number. In this exemplary embodiment, the received data isprint data including a print instruction given to the image formingapparatus. After confirming that the received data is the print data,the data receiving section 311 transfers the data to the data analyzingsection 312.

The data analyzing section 312 extracts the drawing instruction (PDL)from the data received from the data receiving section 311. The dataanalyzing section 312 interprets the data and generates intermediatedata used internally in the image forming apparatus. The data analyzingsection 312 sequentially sends the generated intermediate data to theimage generating section 313.

The data generating section 313 converts the intermediate data receivedfrom the data analyzing section 312 into a bitmap image. In addition,the image generating section 313 compresses the bitmap image and thensequentially sends the compressed image to the printing section 314. Theprinting section 314 prints the bitmap image received from the imagegenerating section 313 onto a paper medium.

As described above, FIG. 4 shows a functional configuration of a networkprinting system when an implementation method for allowing an imageforming apparatus to generate a background image of a printed output isemployed. The client PC 111 includes a print data generating section301, a data sending section 302, and a job restriction informationstorage section 304. On the other hand, the image forming apparatus 131includes a data receiving section 311, a data analyzing section 312, animage generating section 313, an image combining section 414, a printingsection 314, and a meta information image generating section 416.

A user performs a print instructing operation in the client PC 111,whereby the print data generating section 301 is activated. Since theoperation of the print data generating section 301 is the same as thatdescribed with reference to FIG. 3, the description thereof is omitted.The print data generating section 301 sends the generated print data tothe data sending section 302. In addition, the job restrictioninformation storage section 304 sends job restriction information, heldtherein as a result of a user operation performed on the securitysetting dialog shown in FIG. 5, to the data sending section 302.

The data sending section 302 integrates the print data received from theprint data generating section 301 and the job restriction informationreceived from the job restriction information storage section 304 intoprint instruction data to be given to the image forming apparatus.Furthermore, the data sending section 302 sends the integrated printinstruction data to the print server 121 or the image forming apparatus131 or 132. Since FIG. 4 shows logical data flow, the illustration ofthe print server 121 is omitted even if the print server 121 existstherebetween.

On the other hand, in the image forming apparatus, since the operationof the data receiving section 311 is the same as that described withreference to FIG. 3, the description thereof is omitted. The dataanalyzing section 312 extracts the job restriction information and thedrawing instruction (PDL) from the data received from the data receivingsection 311. The data analyzing section 312 sends the extracted jobrestriction information to the meta information image generating section416. Since the operation for processing the drawing instructionextracted by the data analyzing section 312 is the same as thatdescribed with reference to FIG. 3, the description thereof is omitted.In addition, since the operation of the image generating section 313 isthe same as that described with reference to FIG. 3, the descriptionthereof is omitted. The image generating section 313 sends the generatedbitmap image to the image combining section 414.

The meta information image generating section 416 interprets the jobrestriction information received from the data analyzing section 312 andgenerates a background image according to the job restrictioninformation using a technique for embedding information in an image,such as, for example, LVBC. The meta information image generatingsection 416 sends the generated background image to the image combiningsection 414.

The image combining section 414 combines the bitmap image received fromthe image generating section 313 and the background image received fromthe meta information image generating section 416 and sends a bitmapimage of the combined result to the printing section 314. Since theoperation of the printing section 314 is the same as that described withreference to FIG. 3, the description thereof is omitted.

[Embedding of Additional Security Information During Copy Operation ofImage Forming Apparatus]

It is assumed in FIG. 4 that a user gives a print instruction of a filein a client PC before the image forming apparatus creates a printedoutput including additional security information. However, theinstruction to include the additional security information in thebackground of the printed output is not limited to the print instructiongiven from the client PC. In the case of copying a paper document, theimage forming apparatus can be configured to include the additionalsecurity information in the background of the printed output.

A setting operation for embedding additional security informationperformed in the image forming apparatus will be described using FIGS. 9to 13. FIG. 9 is a GUI showing an ordinal copy screen displayed in theimage forming apparatus. A GUI 2801 is a screen of a user interface (UI)and includes a copy tab 2802, a send tab 2803, and so on. The copy tab2802 indicates that a copy function is selected. The send tab 2803 isfor selecting a send or facsimile function. In this exemplaryembodiment, only the copy tab 2802 will be described and the descriptionregarding other tabs is omitted.

The GUI 2801 also includes a state displaying window 2804 for displayingcopy settings and an application mode button 2805 for receiving detailedcopy settings. A setting for embedding the additional securityinformation is performed on a GUI displayed in response to pressing ofthis application mode button 2805.

FIG. 10 is a GUI showing an application mode dialog 2901 displayed inresponse to pressing of the application mode button 2805. Although manyapplication mode settings (for example, a bookbinding setting 2902, areduced layout setting 2903, or the like) are available in this imageforming apparatus, only an information embedding button 2904 regardingembedding of the additional security information will be described.

To perform the setting operation for embedding of the additionalinformation, a user presses the information embedding button 2904 tomake detailed settings. FIG. 11 is a GUI showing an informationembedding setting dialog 3001 displayed in response to pressing of theinformation embedding button 2904. The information embedding settingdialog 3001 includes a copy prohibition setting button 3002 for makingsettings regarding copy prohibition and a tracking information settingbutton 3003 for making settings regarding tracking information.

FIG. 12 is a GUI showing a copy prohibition setting dialog 3101displayed in response to pressing of the copy prohibition setting button3002. The same contents as those shown in the above-described printerdriver setting (see FIG. 5) can be set here. A user operates radiobuttons 3102 to select one of three setting options of “permit copying”,“(always) prohibit copying”, and “set copy permitting conditions (cancelcopy prohibition in response to input of a password)”.

When the third setting option “cancel copy prohibition in response toinput of a password” is selected, a password input field 3103 becomesactive and a user can input a password to cancel the copy prohibition.

FIG. 13 is a GUI showing a tracking information setting dialog 3201displayed in response to pressing of the tracking information settingbutton 3003. In this exemplary embodiment, the tracking informationsetting dialog 3201 includes two checkboxes 3202. A user checks thecheckbox, thereby being able to instruct embedding of a user name ortime information. Although these two kinds of tracking information areshown as an example in this exemplary embodiment, other kinds ofinformation can be included in the tracking information as long as theinformation is held in the image forming apparatus. For example, an IPaddress and a MAC address of the image forming apparatus and a divisionname of an installed place or an office can be attached as the trackinginformation. The above-described various kinds of setting informationare stored in a job restriction information storage section 2704 shownin FIG. 14, which will be described later.

FIG. 14 is a diagram showing a functional configuration of an imageforming apparatus when a background of a printed output includes copyprohibition information at the time of copying of a paper document. Theimage forming apparatus includes an image scanning section 901, an imagecombining section 414, a printing section 314, a job restrictioninformation storage section 2704, and a meta information imagegenerating section 416.

A user places a document on the scanner unit 813 and operates theoperation unit 812 to instruct the start of a copy operation. Inresponse to the instruction, the image scanning section 901(corresponding to a scanning unit) is activated and the copy operationis started. The image scanning section 901 scans the document and sendsimage data thereof to the image combining section 414.

The job restriction information storage section 2704 sends jobrestriction information, held therein as a result of a user operationperformed on various setting dialogs (see FIGS. 9 to 13), to the metainformation image generating section 416. The meta information imagegenerating section 416 interprets the received job restrictioninformation and generates a background image corresponding to the jobrestriction information using a technique for embedding the informationin an image, such as, for example, LVBC. The meta information imagegenerating section 416 then sends the generated background image to theimage combining section 414.

The image combining section 414 combines the document image datareceived from the image scanning section 901 and the background imagereceived from the meta information image generating section 416. Theimage combining section 414 sends the combined image data to theprinting section 314. Since the operation of the printing section 314 isthe same as that described with reference to FIG. 3, the descriptionthereof is omitted. The setting for embedding the additional securityinformation (see FIGS. 9 to 13) is performed in the image formingapparatus in response to a general user's pressing of the applicationmode button 2805 at the time of copying of a document.

In addition, when an administrator of an image forming apparatus createsa printed output using the image forming apparatus, the administratormay set the image forming apparatus so that the additional securityinformation is compulsorily embedded. FIG. 15 is a GUI showing anadministrator setting dialog 3301. Only the administrator can operatethis screen. The setting dialog 3301 includes a time setting button3302, a network setting button 3303, a compulsory information embeddingbutton 3304, and a double-embedding prevention button 3305.

In response to pressing of the compulsory information embedding button3304, information to be embedded is set according to the same flow ofscreens as those displayed in response to pressing of the informationembedding button 2904 (see FIG. 10). Differences between the setting inresponse to pressing of the compulsory information embedding settingbutton 3304 and the setting in response to pressing of the informationembedding button 2904 are as follows.

In the former case, once the administrator makes the setting, thesetting is valid until the administrator cancels the setting and a copyprohibition image is compulsorily embedded when the image formingapparatus creates a printed output. On the other hand, in the lattercase, the setting is made for each job entered by a general user. Inaddition, when the compulsory information embedding setting is made, theinformation embedding button 2904 of the application mode is displayedin gray so that the compulsory information embedding setting and theinformation embedding setting of the application mode cannot be selectedat the same time.

[Detailed Description of Copy Restriction Operation in Image FormingApparatus]

FIG. 16 is a diagram showing a functional configuration of an imageforming apparatus when a copy restriction operation is performed. Theimage forming apparatus 131 includes an image scanning section 901, animage analyzing section 312, a job control determining section 903, asetting information storage section 904, an image processing section905, and a printing section 314. Conditions (date and user authorizationinformation) for canceling a copy operation are set in advance andstored in the setting information storage section 904.

A user places a document including copy restriction information on thescanner unit 813 and operates the operation unit 812 to instruct thestart of a copy operation. In response to the instruction, the imagescanning section 901 is activated and the copy operation is started. Theimage scanning section 901 scans the document image and sends image datathereof to the image processing section 905 and the image analyzingsection 312.

The image analyzing section 312 extracts the copy restrictioninformation included in the image data received from the image scanningsection 901. The image analyzing section 312 sends the extracted copyrestriction information to the job control determining section 903.

The job control determining section 903 compares the copy restrictioninformation received from the image analyzing section 312 with the copyrestriction conditions stored in the setting information storage section904 to determine whether to cancel the copy operation. For example, whenthe radio button 502 (see FIG. 5) for “permit copying” is checked, theimage forming apparatus continues the printing operation. In addition,when a copy permitting condition is set and a character string of apassword input at the textbox 503 matches a character string of apassword input on the authorization dialog 702 shown in FIG. 7, theimage forming apparatus continues the printing operation. In this case,the background image originally included in a document is copied onto arecording medium with being preserved as it is.

Here, if the job control determining section 903 determines that thecopy operation should be canceled, the job control determining section903 sends an instruction for canceling the operation to the printingsection 314. The job control determining section 903 then displays amessage dialog 602 (see FIG. 6) indicating cancellation of the copyoperation on the operation unit 812.

The image processing section 905 converts the image data according to afunction set using the application mode button 2805 (see FIG. 9) or thelike. The processing content of the image processing section 905 variesdepending on the settings made with the application mode button 2805.For example, when the information embedding button 2904 is set, theimage processing section 905 generates a background image according tothe setting and combines the background image and image data of adocument scanned by the image scanning section 901. Through thisoperation, image data including copy restriction information shown inFIG. 2 can be generated.

This series of operations corresponds to generation of a backgroundimage according to the job restriction information held in the jobrestriction information storage section 2704 performed by the metainformation image generating section 416 and combination of thebackground image and the image data of the document scanned by the imagescanning section 901 performed by the image combining section 414.Accordingly, the image processing section 905 performs processingperformed by the image combining section 414, the job restrictioninformation storage section 2704, and the meta information imagegenerating section 416.

Upon receiving the image data from the image processing section 905, theprinting section 314 prints the above-described image data onto a sheetor cancels the printing operation according to the result of thedetermination fed from the job control determining section 903.

Processing performed by the image analyzing section 312 to the settinginformation storage section 904 is not described in an image formingapparatus (see FIG. 14) that functions at the time of copying of a paperdocument so that a background of a printed output includes additionalsecurity information, to simplify the description. In practice, analysisof copy restriction information on the paper document and the jobcontrol determination are performed as in the case of an image formingapparatus (see FIG. 16) that functions to perform the copy restrictionoperation.

[LVBC]

In this exemplary embodiment, low visibility barcodes (LVBC) will bedescribed as an example of a technique for embedding additional securityinformation. Here, an information embedding section indicates a unitincluded in an image forming apparatus that adds desired information toa print target image and prints the combined image onto an image formingmedium (hereinafter, referred to as a sheet), such as a sheet of paperand a sheet used for an overhead projector (an OHP sheet).

The following are requirements for a general information embeddingsection.

To be able to realize embedding of an enough amount of data in a sheetsince the section has to embed information.

To be able to accurately extract, as digital information, informationembedded in a sheet using a color material (toner or ink).

To be resistant to factors preventing information from being extracted,such as rotation, enlargement, reduction, and partial deletion of adocument caused at the time of copying of a document image on a sheet, asignal level decrease and a stain resulting from copying, to someextent.

To have a realtime processing ability that permits information to beextracted at the time of copying or a high processing speed equivalentthereto to prevent a copy restricted document from being copied.

The LVBC described in this exemplary embodiment satisfies theabove-described requirements. FIG. 2 shows an example of a documentincluding the LVBC embedded therein. Many dots 203 apparently embeddedrandomly are formed in an enlarged portion 202 of a sheet 201 inaddition to an image originally included in the document. Theinformation to be added is embedded in this dot.

[Two Areas]

A first area and a second area of an area including embedded additionalsecurity information will now be described. FIG. 17 is a table showingcharacteristic differences between the first area and the second area.The additional security information is separately embedded in two kindsof areas in an extractable manner. The two kinds of areas have differentcharacteristics depending on the utilization manner. The first areaincludes information, such as copy restriction information, needed to beextracted at the high speed during a general scan and copy operation.Since this extraction processing is executed on any kind of documentwithout exception, the delay in the extraction processing affects theentire copy speed. Accordingly, for example, a capability substantiallyequal to that of the scan processing is required regarding the analysisspeed. In addition, since an extremely small amount of the copyrestriction information is needed, the data size of the additionalsecurity information to be embedded can be small.

On the other hand, the tracking information is embedded in the secondarea. Since the tracking information is extracted when an administratorperforms analysis operation at the time of exposure of informationleakage, the extraction processing does not have to be performed duringthe normal copy operation. Accordingly, even if the realtime processingis not guaranteed, the processing speed does not affect the entire copyspeed and a decrease in the processing speed is permitted to someextent.

Since the tracking information has to include a large amount ofinformation, the data size has to be relatively large. A name of a usercreated the document, a name of an organization to which the userbelongs, a serial number of an image forming apparatus, and an IPaddress or a MAC address can be considered as information to be embeddedas the tracking information. Furthermore, information such as aninstalled place, a print date, and a print time may be used as thetracking information.

To satisfy these different requirements, the additional securityinformation can be embedded in both of the first area and the secondarea in the LVBC according to this exemplary embodiment. It is possibleto select extraction of only the first area, extraction of only thesecond area, or extraction of both areas according to the utilizationstate (use case). In addition, when extracting only the first area, theimage forming apparatus according to this exemplary embodiment canimprove the analysis speed and perform the extraction processing at aspeed that does not affect the productivity of the copy operation.

FIG. 18 is a schematic diagram showing an arrangement of first areas andsecond areas when information is embedded in a sheet. In the drawing, afirst area 1101 is represented by a rectangle. The same data is storedin the periodically arranged first areas 1101 similarly represented byrectangles. Repeated embedding of first areas 1101 increases theredundancy and improves the reliability to the noise and the error.

A second area 1102 is represented by a larger rectangle. As in the caseof the first area 1101, the second areas 1102 represented by rectanglesare arranged periodically. The information of the second area 1102 isnot embedded in the first area 1101 and the information is exclusivelywritten in the respective areas. In addition, in the drawing, a size1103 of the first area, a repeated cycle 1104 of the first areas, and asize 1105 of the second area are shown.

[LVBC Embedding Method]

A method for embedding LVBC will now be described. In addition to animage printed onto a sheet, a dot pattern called grid is printed toembed additional security information in the LVBC. The dots 203 shown inFIG. 2 constitute the grid. The grid is an aggregate of dots arrangedapart from one another at an even interval in vertical and horizontaldirections. If the shortest distance between dots on the grid isconnected with a virtual line (guide line), a virtual lattice patternwhere lines are drawn at a constant interval in vertical and horizontaldirections appears.

The additional security information is input as binary data having asize equal to or smaller than a predetermined value. Additional data isrealized by displacement of dots (drifting from the center) in eightdirections (up, down, left, and right) with respect to the dotsconstituting the grid and is embedded as the additional securityinformation.

FIG. 19 is a diagram illustrating an example of embedding binary data“010111110011” as additional security information. In the drawing, lines1201 extending in vertical and horizontal directions show virtual guidelines indicating the grid position. If the shortest distance of the gridis connected in this manner, a lattice pattern appears.

No dot is placed at a center 1202. In practice, for example, a dot isdisplaced and arranged at a position 1203 apart from the center 1202.“010111110011” is divided into three-bit values “010”, “111”, “110”, and“011”. Furthermore, decimal conversion is performed on each three-bitvalue and the three-bit values are converted into 2, 7, 6, and 3. Eachdot constituting the grid is displaced in one of the eight directionscorresponding to the value, thereby being able to represent theinformation. In this case, the values 2, 7, 6, and 3 can be embedded asthe information by displacing the position of the dots in the upperright direction, the lower right direction, the downward direction, andthe left direction, respectively.

By repeating such processing, the additional security information havinga size of 2000 bytes at most can be embedded in a sheet as the LVBC.Furthermore, repeated embedding of dots representing the additionalsecurity information increases the redundancy and can improve thereliability to misconception of an image and a stain, creases, andpartial destruction of a sheet. Details regarding the analysis will bedescribed in a description for an LVBC analysis method, which will begiven later.

Analysis of the LVBC requires an accurate examination of the gridposition and it is desirable that the dots displace in the eightdirections at an equal probability. However, there is a case where aspecific data, such as a value 0, is desired to be embedded more oftenand the equal probability may not be achieved without any processing.Accordingly, in this exemplary embodiment, reversible scrambleprocessing (e.g., common key encryption processing using a unique key)is performed on the information to be embedded and the information isembedded after the displacement of the dot is randomized. The metainformation image generating section 416 generates the additionalsecurity information.

Embedding of the LVBC can be realized with a relatively simple mechanismsince it is D/A conversion in which the additional security information,which is digital data, is recorded on a sheet as analog data. Theinformation is embedded in the above-described two areas by applying theabove-described embedding method.

The first areas 1101 and the second areas 1102 shown in FIG. 18 arecombined when the data to be embedded is generated. Since the combinedresult is treated as one piece of embedded data, this embedded data isconverted into each dot displacement (see FIG. 19) and is embedded.Accordingly, when the two areas shown in FIG. 18 are enlarged in a unitof dot, the information is embedded by the displacement of each dot asshown in FIG. 19. The pattern of the additional security informationconstituted by the two areas is combined by the image combining section414 and is printed by the printing section 314.

[LVBC Analyzing Method]

An LVBC analyzing method will now be described. FIG. 20 is a blockdiagram showing an exemplary configuration of the data analyzing section312 that analyzes the LVBC. The data analyzing section 312 isconstituted by a sub module including a dot detecting unit 1302, a dotanalyzing unit 1303, an absolute coordinate list storage unit 1304, adot converting unit 1305, a relative coordinate list storage unit 1306,a first area decrypting unit 1307, and a second area decrypting unit1308.

The dot detecting unit 1302 extracts a given dot from anadditional-security-information-containing image (in which an originalimage and additional security information coexist) and determinescoordinates. The dot analyzing unit 1303 eliminates unnecessary dots,such as dots constituting halftone, from the dots detected by the dotdetecting unit 1302. The absolute coordinate list storage unit 1304stores a list of absolute coordinates of a plurality of dots resultingfrom the analysis of the dot analyzing unit 1303.

The dot converting unit 1305 detects a rotation angle and a gridinterval based on the list of the absolute coordinates of the pluralityof dots stored in the absolute coordinate list storage unit 1304 andconverts the absolute coordinates into relative coordinates from thegrid position. Meanwhile, the grid interval detected here is used indetermination of destruction of embedded security information at thetime of enlargement/reduction.

The relative coordinate list storage unit 1306 stores relativecoordinates, from the grid position, of the plurality of dots analyzedby the dot converting unit 1305. The first area decrypting unit 1307extracts the first area of the embedded additional security informationand outputs the extraction result to a subsequent stage. The second areadecrypting unit 1308 extracts the second area of the embedded additionalsecurity information and outputs the extraction result to a subsequentstage. Meanwhile, the size of the second area detected at this time isused in determination of destruction of the embedded securityinformation at the time of specification of an area or execution ofmovement.

“The subsequent stage” used here indicates a functional module thatutilizes the additional security information. For example, thesubsequent stage corresponds to a functional module that cancels aprinting operation when copy restriction information is extracted as theadditional security information and that displays sheet ownerinformation on an operation display when tracking information isextracted.

[Dot Detection]

An operation of the dot detecting unit 1302 will now be described. Thedot detecting unit 1302 receives image data of a document scanned by anoptical scanner as a multilevel monochrome image. Although theinformation of LVBC is embedded as bilevel monochrome dots 203 (see FIG.2), the image data is received in a state where the signal level isslightly dulled due to influences of a state of the toner adhered at thetime of embedding, treatment of a sheet, and an optical system used atthe time of scanning. Accordingly, the received dots are detected toremove these influences and the center of the received dots isrecognized as coordinate positions, whereby the extraction accuracy isincreased in the LVBC.

FIG. 21 is a diagram illustrating detection of dots performed by the dotdetecting unit 1302. A gap is examined on an image in four directions todetermine that a dot is an isolated point on the image. In the drawings,directions 1401 to 1404 represented by arrows indicate directions inwhich existence or absence of an isolated point is examined. Forexample, when a result of an examination in the vertical direction 1401is “white”, “white”, “black”, “black”, “white”, and “white”, the blackportion may be an isolation point. However, with this result alone, itis undeniable that the black portion may be a line extending in thehorizontal direction. Similarly, when a black portion is determined tobe possibly an isolated point with an examination in the horizontaldirection 1402 alone, the black portion may be actually a line extendingin the vertical direction. In this exemplary embodiment, the dotdetecting unit 1302 performs the examination of an isolated point in thefour directions 1401 to 1404, thereby improving the examinationaccuracy. For example, when all results of the examinations in thedirections 1401 to 1404 match at the same time in a given area, it ispossible to identify that an isolation point is located at thisposition.

[Dot Analysis]

An operation of the dot analyzing unit 1303 will now be described. Thedots detected by the dot detecting unit 1302 may be dots other thanthose constituting the LVBC. For example, a dot pattern for expressinghalftone included in a document image and isolated points (e.g., a voicesound symbol of hiragana (one kind of Japanese character)) originallyincluded in the document correspond to such dots. To remove the isolatedpoints that are not dots constituting the LVBC, halftone elimination hasto be performed.

FIG. 22 is a graph for use in explanation of the halftone elimination. Ahistogram showing a shape of a dot at the vertical axis, density at thehorizontal axis, and a dot appearance frequency at the density of apoint is illustrated. Higher density (darker color) indicates higher dotappearance frequency. Here, since dots having a uniform shape areembedded at uniform density at the time of embedding, the appearancefrequency of the dots of the LVBC shows a peak 1501 at a narrow range ofthe graph.

On the other hand, since the shape and density of the dots are notstandardized in halftone, the dots sparsely appear at a broader range ofthe graph and the appearance frequency is relatively low. By utilizingthis characteristic, a position at which the appearance frequency showsa narrower peak is identified as a dot of the LVBC and stored in theabsolute coordinate list storage unit 1304. Other dots are eliminated.Through this operation, the LVBC dots are stored in the absolutecoordinate list storage unit 1304.

[Dot Conversion]

An operation of the dot converting unit 1305 will now be described. Anangle at which LVBC dots are embedded at the time of printing differsfrom an angle of dots in a scanned image because of a difference in adirection of a document placed on a scanner and a small difference inangles at an analog level. Accordingly, the rotation angle has to bedetected and corrected. In addition, since information is embedded indisplacement from a grid position to which the dot belongs in the LVBC,the grid has to be reproduced and a grid interval has to be accuratelydecided.

FIG. 23 is a schematic diagram showing a method of measuring a gridinterval. A distance X between a focused dot 1601 and a nearest dot 1602corresponds to a grid interval. Although there are four nearest dotsfrom the focused point in upward, downward, left, and right directions,a range of 90 degrees on the right of the focused dot 1601 is treated asa target in which the nearest dot is searched, to simplify thecalculation. More specifically, if a given dot (a, b) other than afocused dot (x, y) satisfies Equation (1), the dot (a, b) is notincluded in the calculation target.a−x≦0 or |a−x|≦|b−y|  (1)The dot (a, b) that gives the smallest distance between the focused dot(x, y) and the dot (a, b) is recognized as a neighboring dot and thedistance X between the two dots is treated as a candidate of the gridinterval.

Here, since both the focused dot 1601 and the neighboring dot 1602 aredisplaced to embed the information, the distance therebetween mayindicate a value different from the actual grid interval. In addition,the dot recognized as the LVBC dot may be a halftone pattern that thedot analyzing unit 1303 has failed to eliminate. Thus, the dotconverting unit 1305 measures the inter-grid distance regarding all offocused dots (x, y) and creates a histogram showing a frequency for eachinter-grid distance regarding all of the focused dots.

FIG. 24 is a histogram showing a frequency of inter-grid distances as anexample. The horizontal axis represents values of the distance X that isa candidate of the inter-grid distance, whereas the vertical axisrepresents the frequency at which the distance X is measured regardingthe focused point (x, y). The distance X with the highest frequency 1701is identified as the inter-grid interval.

If an appearance probability of displaced position of the focused dot1601 and the neighboring dot 1602 from the respective grid is the samein the vertical and horizontal directions, the distance X at the modeposition 1701 corresponds to the inter-grid interval based on thehistogram of many focused dots. This inter-grid interval X is used indetermination of destruction of additional security information.

FIGS. 25A to 25D are diagrams illustrating correction of a grid rotationangle. Referring to FIG. 25A, an angle to the neighboring dot ismeasured regarding all dots. Since an angle between the focused dot andthe neighboring dot is originally one of 0 degrees, 90 degrees, 180degrees, and 270 degrees, the rotation angle can be decided bycorrecting a difference in the measured angle. In this case, an angle θbetween each focused dot and the neighboring dot is represented byEquation (2) using a vector (dx, dy) from the focus point to theneighboring point.θ=a tan 2(dy,dx)  (2)FIG. 25B shows vectors A, B, C, D from the focused dot to the respectiveneighboring dots. However, since both the focused dot and theneighboring dots are actually displaced slightly from the grid positionto embed the information, the angle θ is measured regarding all of thefocused point similarly.

If an appearance probability of displaced positions of the focused dots1601 and the neighboring dot 1602 from the respective grid is the samein the vertical and horizontal directions, an average grid rotationangle can be measured by adding the angle differences for all of thefocused dots.

FIG. 25C shows vectors of some dots. By superimposing these angles, thevalue can be approximated to the grid rotation angle. More specifically,a reference vector is calculated again and again for the angle θ at eachfocused dot and a total angle φ is determined based on a sum of all ofthe reference vectors (see FIG. 25D). When the sum of the referencevectors is represented by (A, B), A and B are represented as Equation(3).

$\begin{matrix}{{A = {\sum\limits_{i}\;{\cos( {4\;\theta_{i}} )}}}{B = {\sum\limits_{i}\;{\sin( {4\;\theta_{i}} )}}}} & (3)\end{matrix}$

The grid rotation angle φ can be approximated by Equation (4).φ=a tan 2(B,A)  (4)Here, reversed rotation of the grid rotation angle is executed on theabsolute coordinate list stored in the absolute coordinate list storageunit 1304 to correct the grid angle. This correction of the rotationangle is in a unit of 90 degrees. However, in fact, the correction isnot limited to four angles, 0 degrees (proper), 90 degrees, 180 degrees,and 270 degrees. This limitation will be described later.

FIGS. 26A and 26B are diagrams showing a rotation correction result anda determined grid position. FIG. 26A shows an absolute coordinate listof rotation-corrected LVBC dots. Referring to FIG. 26B, virtual linesare drawn in X and Y directions at each grid interval determined by thedot converting unit 1305 and intersection points of these lines aretreated as grids. Displacement of coordinates of the actually marked dotfrom this grid position is measured.

FIG. 27 is a diagram showing conversion of grid displacement into actualdata. Displacement from the grid is represented by information of 0 to 7located in the vertical and horizontal directions. In FIG. 27, sincevalues 2, 7, 6, and 3 can be extracted, these values are converted intothree-bit binary values and integrated into one value, and embedded data“010111110011” is extracted from these dots. Similarly, by performingsuch an extraction operation on all of dots, extraction of embeddedinformation of several tens to several thousands bytes can be executed.

[Decision of First Area]

Decision of first and second areas will now be described. Since the size1103 of the first area, the repeated cycle 1104, and the position of thefirst area shown in FIG. 18 are unknown, the followings are decided.First, the repeated cycle 1104 of the first area 1101 is decided. Thefirst area 1101 periodically includes the same data. Whenautocorrelation is determined in the vertical direction using apredetermined offset, the autocorrelation increases if the offset valuematches the repeated cycle 1104. As a result, the repeated cycle 1104can be decided.

FIG. 28 is a graph showing a calculation example of an autocorrelationvalue for an offset value. The autocorrelation used herein is a methodfor evaluating a frequency at which specific embedded data appearsperiodically. In addition, the autocorrelation value is a value forevaluating the similarity of the embedded data at a specific offsetvalue. An autocorrelation function COR(A, B) for calculating theautocorrelation value is represented by Equation (5).COR(A,B)=bitcount(not(A xor B))  (5)Here, “xor” represents exclusive OR of two terms. “Not” representsnegation, whereas “bitcount” is a function for counting the number of avalue 1 included in a bit string. For example, when A and B are equal to“010b” and “011b”, respectively, not (A xor B)=not (001b)=110b, and avalue of bitcount thereof is equal to 2.

Suppose that the first area is a matrix having predetermined width andheight and a bit string for evaluating the first area is denoted by CELL(x, y), where x and y represent coordinates in the vertical andhorizontal directions, respectively. For example, when the width andheight of the first area are equal to 8 and 8, respectively, the lengthof the bit string CELL (x, y) is equal to 3 bits×8×8=192 bits in thefirst area whose upper left point is represented by x and y. Theautocorrelation value of all of coordinates at a given offset isrepresented by Equation (6)

$\begin{matrix}{{{Autocorrelation}\mspace{14mu}{Value}\mspace{14mu}({Offset})} = {\sum\limits_{x}\;{\sum\limits_{y}\;{{COR}( {{{CELL}( {x,y} )},{{CELL}( {x,{y\text{-}{offset}}} )}} )}}}} & (6)\end{matrix}$

For example, when the size 1103 of the first area is equal to 8 and therepeated cycle 1104 is equal to 8×3=24, the autocorrelation value showsa peak 2101 at an offset equal to 24. The offset equal to 24 can bedecided as the repeated cycle 1104.

The position and size of the first area 1101 will now be decided. Therepeated cycle of the first area is decided by determining theautocorrelation. The position of the first area therein and the size ofthe first area have to be decided.

FIG. 29 is a schematic diagram illustrating a method for deciding theposition of the first area. Since the repeated cycle is decided inadvance, a given area having the size equal to repeated cycle isextracted from the relative coordinate list storage unit 1306.Autocorrelation is determined sequentially and repeatedly at an areaneighboring the area. If the same data appears at the repeated cycle inthe first area 1101, the correlation is high. If the same data does notappear at the repeated cycle in the second area 1102, the correlation islow. By utilizing this characteristic, a start position of a part havinghigh correlation is identified as a start position of the first area,and the size between the start and the end of this part having the highcorrelation can be decided as the size of the first area.

[Decryption of First Area]

Data of the first area is decrypted based on the position and size ofthe first area decided in the above-described procedure. Since adetermination error due to a measurement error and a noise may occurusing only a single area, positions of dots marked in all first areasare totalized, a mode value thereof is adopted, and an occurrenceprobability of the value is calculated.

FIG. 30 is a schematic diagram showing totalization of the first areas.In the drawing, first areas 2301 to 2303 are shown at differentpositions. By superimposing these areas, a totalized result 2304 of allareas is obtained. Although a difference resulting from a noise and anerror exists, this value can be adopted since the mode value is decidedby the totalized result of all areas.

Actual decryption is then executed. At this phase, since an influence ofa noise and an error can not be eliminated, an error correctionoperation is performed on a decrypted result. First, as shown in FIG.27, the displacement from the grid is extracted and this displacement isconverted into a data corresponding to the displaced position to extracta data string embedded in the first area. When not only actually usedcopy restriction data but also destruction of data can be detected, anerror-correcting code is recorded in this data string at the time ofembedding.

Although many kinds of error-correcting code are known as techniques inthe related art, low density parity check (LDPC) is used here. The LDPCis known to have a significantly high error correcting capability andshow a characteristic resembling the Shannon limit. A detaileddescription of the LDPC is omitted. In addition, any method other thanthe LDPC can be employable as long as the method has the characteristicof the error-correcting code. The use of the error-correcting codeallows the embedded data to be extracted even if the extracted gridincludes a certain level of error and noise.

Furthermore, as described in the correction of the rotation angle, sincethe rotation angle is corrected in a unit of 90 degrees, there are fourtypes of extracted data, a proper data, data obtained by rotating theproper data by 90 degrees, data obtained by rotating the proper data by180 degrees, and data obtained by rotating the proper data by 270degrees.

Accordingly, the extracted data is rotated by 0 degrees, 90 degrees, 180degrees, and 270 degrees, and decryption is executed on the resultswhile performing error correction using the LDPC. The error-correctingcode functions only for the proper rotation angle and the data can beextracted successfully.

FIG. 31 is a diagram showing a decryption operation for performing errorcorrection in consideration with the rotation. This example shows a casewhere a result rotated by 270 degrees with respect to the proper data isextracted. First, the error-correcting operation is executed on anextracted data 2401. Even if the proper data includes theerror-correcting code, the error cannot be corrected since the rotationmakes the data meaningless.

The error-correcting operation is then executed on data (90-degreerotated data) 2402 resulting from 90-degree rotation performed on theextracted data 2401. Similarly, the error correction fails and the datacannot be extracted. Furthermore, the error-correcting operation isexecuted on data (180-degree rotated data) 2403 resulting from 90-degreerotation performed on the 90-degree rotated data 2402. In this case, theerror correction also fails and the data cannot be extracted.

At last, the error-correcting operation is executed on data (270-degreerotated data) 2404 resulting from 90-degree rotation performed on the180-degree rotated data 2403. Since this data is the proper data, theerror correction operation succeeds. Accordingly, this data can beadopted as the extracted data. Even if the error-correcting operationfails regarding the 270-degree rotated data 2404, for example, a casewhere data extraction fails due to many errors and noises can beconsidered. In this manner, the embedded data contained in the firstarea can be extracted.

[Decision of Second Area]

The second area is used to register tracking information. Informationregistered in this area is not necessarily needed at the time ofexecution of a copy operation. Accordingly, if the information is notneeded, a decrease in the entire processing speed can be suppressed byomitting decryption of the second area.

A method for deciding the second area will be described. First, as inthe case of the first area, autocorrelation of the second area isdetermined. Since the second area is embedded at an interval integralmultiple of the repeated cycle of the first area, an amount of thecalculation can be reduced because the autocorrelation is determined atone of the integral multiples (e.g., 24, 48, 72, . . . ) of the repeatedcycle of the first area. Furthermore, a repeated cycle of the secondarea is equal to the size of the second area. FIG. 32 is a graph showinga calculation example of an autocorrelation value for an offset value inthe second area. In this case, since the autocorrelation value shows apeak at an offset value equal to “72”, the size of the second area isequal to 72.

At last, a start position of the second area is identified. Since thestart position of the second area is set to match the start position ofthe first area at the time of embedding, the start position can benarrowed down to one of the start positions of the first areas.

The error-correction code is utilized in decision of the start positionof the second area. As in the case of the first area, theerror-correcting code is included in the second area in addition to theembedded data. Since the size of the second area is already known, theerror-correcting operation is sequentially executed from the topposition of the first area.

FIG. 33 is a schematic diagram showing a method for deciding the startposition of the second area. FIG. 33 shows that the size of the secondarea is a quadruple of the repeated cycle of the first area based on theautocorrelation. Since one of 4×4=16 corresponds to the start positionof the second area, the error-correction operation is executed whilemoving the start position to positions represented by values 1, 2, 3, 4,5 and so on. If the error-correcting operation succeeds, the positioncan be adopted as the start position of the second area. Based on therepeated cycle decided here and the magnification, a dot size invertical and horizontal directions of the second area can be calculated.This dot size in the vertical and horizontal directions of the secondarea is used in determination of destruction of additional securityinformation. In this manner, embedded information contained in thesecond area can be extracted.

[Double-Embedding of Additional Security Information]

An operation regarding further embedding of additional securityinformation in a document previously including additional securityinformation (so-called double-embedding of additional securityinformation) will now be described.

FIG. 34A shows a case where double-embedding of additional securityinformation does not occur, whereas FIG. 34B shows a case wheredouble-embedding of additional security information occurs. Theabove-described information embedding setting of the application mode orthe compulsory information embedding setting of the administratorsetting (a setting for compulsorily embedding and printing additionalinformation in a scanned document) is selected in an image formingapparatus 131.

Referring to FIG. 34A, if the image forming apparatus 131 copies adocument 3401 not including additional security information embeddedtherein, a printed output 3402 in which additional security informationis embedded according to the information embedding setting of theapplication mode (or the compulsory information embedding setting) isobtained.

On the other hand, referring to FIG. 34B, if the image forming apparatus131 copies a document 3403 previously including additional securityinformation embedded therein, a printed output 3404 in which additionalsecurity information is further embedded according to the informationembedding setting of the application mode is obtained. As in the case ofFIG. 34A, the setting may be the compulsory embedding setting instead ofthe information embedding setting of the application mode.

In this case, two pieces of information, additional security informationoriginally embedded in the document and additional security informationnewly embedded by the image forming apparatus 131, are embedded in theprinted output (printed material) 3404. Accordingly, another coded imageis combined at an area overlapping an area of a document image where acoded image has previously been combined. The image analyzing section312 may be unable to successfully obtain these pieces of additionalsecurity information from a document having doubly embedded additionalsecurity information. Thus, further embedding of additional securityinformation in a document previously having embedded additional securityinformation destroys the original additional security information, whichbecomes a security hole.

FIGS. 35A and 35B are diagrams illustrating double-embedding ofadditional security information in a print job as in the case of a copyjob. A difference from the copy job (see FIGS. 34A and 34B) is that adocument input to an image forming apparatus 131 is not paper but isprint data fed from a client PC 111.

FIG. 35A shows a print job in which double-embedding of additionalsecurity information does not occur, whereas FIG. 35B shows a print jobin which double-embedding of additional security information occurs.Referring to FIG. 35B, a printed output 3504 in which additionalsecurity information is further embedded by the image forming apparatus131 in print data 3503 including additional security informationembedded by a printer driver is obtained.

[Operation of Job Control Determining Section (Pattern 1)]

As described with reference to FIGS. 34A and 34B and FIGS. 35A and 35B,the original additional security information is destroyed in the printedoutput 3404 (or 3504) including doubly embedded additional securityinformation, which undesirably becomes a security hole.

An operation performed by the job control determining section 903 toprevent further additional security information from being embedded inthe document 3403 (or 3503) previously including the embedded additionalinformation will now be described. FIGS. 36 and 37 are flowchartsillustrating a procedure of an operation of the job control determiningsection 903.

At the time of a start of a copy operation, the job control determiningsection 903 determines whether to instruct the printing section 314 toprint or to cancel printing of image data obtained by performingnecessary image processing on an image scanned by the image scanningsection 901.

First, the job control determining section 903 waits for the imagescanning section 901 to complete scanning an image (STEP S1). After thecompletion of scanning of the image, the job control determining section903 extracts first information (information embedded in the first area)of the additional security information from the scanned image at theimage analyzing section 312 (STEP S2). The job control determiningsection 903 determines whether the extraction of the first informationhas succeeded (STEP S3).

If the extraction of the first information has not succeeded (NO of STEPS3), the job control determining section 903 sets a flag LVBC_FLAG toFALSE and determines that additional security information is notoriginally embedded in the scanned image (STEP S4). This flag LVBC_FLAGis registered in a storage medium that the job control determiningsection 903 can access. The job control determining unit 903 thenadvances the process to STEP S14.

On the other hand, if the extraction of the first information hassucceeded at STEP S3 (YES of STEP S3), the job control determiningsection 903 sets the flag LVBC_FLAG to TRUE and determines thatadditional security information is embedded in the scanned image (STEPS5). The job control determining section 903 detects existence orabsence of a conditioned copy restriction code embedded (included) inthe first information (STEP S6).

If the conditioned copy restriction code exists (is included) (YES ofSTEP S6), the job control determining section 903 extracts secondinformation (information embedded in the second area of the additionalsecurity information) (STEP S10). The job control determining section903 compares an authorization code extracted from the second area with apassword input on the authorization dialog 702 (see FIG. 7) (STEP S11).If it is determined that the authorization has failed (the passwords donot match) at STEP S11 (NO of STEP S11), the job control determiningsection 903 instructs the printing section 314 to cancel the printingoperation (STEP S12). Meanwhile, character strings can be compared orresults of the one-way hush function applied to the character stringscan be evaluated to compare the passwords. The job control determiningsection 903 displays a message indicating cancellation of the job on anoperation panel (STEP S13). The job control determining section 903 thenterminates this operation.

On the other hand, if it is determined that the authorization hassucceeded (the passwords match) at STEP S11 (YES of STEP S11), the jobcontrol determining section 903 advances the process to STEP S14.

In addition, if the conditioned copy restriction code is not detected atSTEP S6 (NO of STEP S6), the job control determining section 903determines whether copying is permitted (STEP S7). If copying ispermitted (YES of STEP S7), the job control determining section 903advances the process to STEP S14. Here, a case where copying ispermitted corresponds to a case where a document is printed under asetting of “permit copying” selected with the radio button 502 (see FIG.5) and a case where a document is printed under a setting of “permitcopying” selected with the radio button 3102 (see FIG. 12).

On the other hand, if copying is not permitted at STEP S7 (NO of STEPS7), the job control determining section 903 instructs the printingsection 314 to cancel the printing operation (STEP S8). Here, a casewhere copying is not permitted corresponds to a case where a document isprinted under a setting of “prohibit copying” selected with the radiobutton 502 (see FIG. 5) and a case where a document is printed under asetting of “prohibit copying” selected with the radio button 3102 (seeFIG. 12). The job control determining section 903 displays a messageindicating cancellation of a job on an operation panel (STEP S9). Thejob control determining section 903 then terminates this operation.

After the processing of STEP S4 or in the case of YES at STEPs S7 andS11, the job control determining section 903 determines whether a userhas selected the additional-security-information embedding setting orwhether an administrator has selected the compulsory informationembedding setting (STEP S14). The user selects theadditional-security-information embedding setting by pressing theinformation embedding button 2904 (see FIG. 10) on the application modesetting dialog. The administrator selects the compulsory informationembedding setting by pressing the compulsory information embeddingsetting button 3304 (see FIG. 15) on the administrator setting dialog.In the case of YES at STEPs S7 and S11, the processing performed by thejob control determining section 903 at STEP S14 corresponds to anoperation of a setting determining unit.

If the embedded setting is not selected (NO of STEP S14), the jobcontrol determining section 903 instructs the printing section 314 toprint the document to be copied (hereinafter, referred to as a copytarget document) (STEP S15). In the processing performed at STEP S15,the print instruction can be issued since theadditional-security-information embedding setting does not exist at STEPS14 regardless of whether the additional security information haspreviously been embedded in the copy target document. Meanwhile, theoperation performed by the job control determining section 903corresponds to an operation of a print permitting unit.

On the other hand, if it is determined thatadditional-security-information embedding setting is selected at STEPS14 (YES of STEP S14), the job control determining section 903determines whether additional security information has previously beenembedded in the copy target document based on the value of the flagLVBC_FLAG (STEP S17).

If the flag LVBC_FLAG indicates FALSE, i.e., if the additional securityinformation is not embedded, the job control determining section 903instructs the printing section 314 to print image data includingadditional security information embedded by the image processing section905 (STEP S18). In the processing performed at STEP S18, the instructionfor printing the image data including the additional securityinformation embedded by the image processing section 905 can be issuedsince the additional security information is not originally embedded inthe copy target document.

After the processing of STEP S15 or S18, the job control determiningsection 903 determines whether a following copy target document exists(STEP S16). If the following copy target document exists (YES of STEPS16), the job control determining section 903 returns the process toSTEP S1 and waits for the next document to be scanned. On the otherhand, if the following copy target document does not exist (NO of STEPS16), the job control determining section 903 terminates this operation.

In addition, if it is determined that the flag LVBC_FLAG indicates TRUEat STEP S17, the job control determining section 903 instructs theprinting section 314 to cancel printing of image data includingadditional security information embedded by the image processing section905 (STEP S19) because embedding of further additional securityinformation means double embedding and this has to be prohibited. Here,a case where the flag LVBC_FLAG is determined to be TRUE corresponds toa case where additional security information has previously beenembedded in the copy target document. An operation performed by the jobcontrol determining section 903 at STEP S19 to cause the printingsection 314 to suspend the printing corresponds to an operation of aprint suspending unit. As shown in FIG. 16, the image forming apparatusaccording to this exemplary embodiment does not have a configuration forallowing the job control determining section 903 to prohibit the imageprocessing section 905 from combining images (which is indicated sincean arrow is not extending therebetween). Accordingly, the job controldetermining section 903 prohibits double-embedding of additionalsecurity information by canceling this printing operation.

Alternatively, the image forming apparatus may be configured so that thejob control determining unit 903 can prohibit the image processingsection 905 from combining the image, for example, and the job controldetermining section 903 may prohibit the embedding of new additionalsecurity information (i.e., combination of a new coded image) if theadditional security information is possibly embedded doubly (if the flagindicates TRUE at STEP S17).

The job control determining section 903 displays a message indicatingcancellation of the job on an operation panel (STEP S20). The jobcontrol determining section 903 then terminates this operation.

The image forming apparatus according to the first exemplary embodimentcan prevent new additional security information from being combined andprinted on a document previously including embedded additional securityinformation. More specifically, when digital data is doubly embedded ina copy job, the image forming apparatus can prevent the double-embeddingoperation by canceling the job. Through this operation, a copy operationcan be performed without destroying the additional security informationand convenience of a user improves.

Second Exemplary Embodiment

Since configurations of an image forming apparatus and a networkprinting system according to a second exemplary embodiment of thepresent invention are the same as those of the first exemplaryembodiment, a description thereof is omitted by using the same numerals.

[Operation of Job Control Determining Section (Pattern 2)]

In the first exemplary embodiment, when additional security informationis possibly embedded doubly, a print operation is cancelled. In thesecond exemplary embodiment, the printing operation is not cancelledunconditionally but whether to permit printing is decided according to asetting of an administrator even if the additional security informationis possibly embedded doubly.

FIGS. 38 and 39 are flowcharts illustrating a procedure of an operationperformed by a job control determining section 903 when permission orprohibition of a printing operation is decided according to anadministrator setting in accordance with the second exemplaryembodiment.

First, an administrator setting for permitting or prohibiting theprinting operation when additional security information is embeddeddoubly will be described. FIG. 40 is a GUI showing a double-embeddingprevention setting dialog 3701 displayed in response to pressing of adouble-embedding prevention button 3305 on an administrator settingdialog (see FIG. 15).

Radio buttons 3702 allow one of an option “IGNORE” for invalidatingadditional-security-information embedding setting and an option “CANCEL”for canceling a printing operation as in the case of FIG. 36 to beselected when double-embedding possibly occurs. In this embodiment,copying is permitted if “permit copying” is embedded in a document. Thedocument is dealt in the same way with a document in which noinformation is embedded or no coded image exists. Therefore, it meansnothing at a glance that “permit copying” is embedded. However, “permitcopying” means a lot. Suppose that the “IGNORE” option should beselected, then a coded image is not combined with the document in which“permit copying” is embedded. On the other hand, a coded image iscombined with the document in which no information is embedded or nocoded image exists. Thus, “permit copying” means a lot because it makescopier not combine a coded image with a document.

FIG. 41 is a diagram showing a functional configuration of an imageforming apparatus for realizing operations of “IGNORE” and “CANCEL”.Comparison of the functional configuration of the image formingapparatus shown in this drawing and that of the image forming apparatusshown in FIG. 16 reveals that a line 911 indicating exchange of datafrom the job control determining section 903 to an image processingsection 905 is added. This addition allows the job control determinationsection 903 to control the image processing section 905 to or not toembed the information according to a determination result of the jobcontrol determining section 903. The same numerals are attached toelements that are common to those shown in FIG. 16.

If the job control determining section 903 determines that theinformation embedding is not performed at the image processing section905, embedding setting is treated as invalid even if theadditional-security-information embedding setting is selected. The imageprocessing section 905 operates to transfer an image received from animage scanning section 901 to a printing section 314 without processingthe image. To realize this operation, the image processing section 905starts the operation after receiving the determination result of the jobcontrol determining section 903 when the additional-security-informationembedding setting is selected. This is indicated by an existence of thearrow 911 between the job control determining section 903 and the imageprocessing section 905.

An operation for invalidating the additional-security-informationembedding setting or for canceling a job regarding a document 3403previously including embedded additional security information accordingto the administrator's setting of the double-embedding prevention button3305 will be described.

Referring to FIGS. 38 and 39, since processing of STEPs S31 to S47 isthe same as that of STEPs S1 to S17 shown in FIGS. 36 and 37, adescription thereof is omitted.

If a flag LVBC_FLAG indicates FALSE at STEP S47, the job controldetermining section 903 instructs the image processing section 905 toembed additional security information since additional securityinformation has not been embedded (STEP S48). Furthermore, the jobcontrol determining section 903 instructs the printing section 314 toprint a copy target document (STEP S49). The job control determiningsection 903 then terminates this operation.

On the other hand, if the flag LVBC_FLAG indicates TRUE at STEP S47, thejob control determining section 903 instructs the image processingsection 905 to invalidate the additional-security-information embeddingsetting (STEP S50). The job control determining section 903 determinesthe administrator's setting of the double-embedding prevention button3305 (STEP S51).

If the double-embedding prevention button 3305 is set to “IGNORE”, thejob control determining section 903 instructs the printing section 314to print the copy target document (STEP S52). The print instructiongiven at STEP S52 is an instruction for performing a printing operationwithout embedding the additional security information according to theadministrator's setting when the additional security information ispossibly embedded doubly. Meanwhile, reception of this instructioncorresponds to an operation of a receiving unit.

On the other hand, if the double-embedding prevention button 3305 is setto “CANCEL” at STEP S51, the job control determining section 903instructs the printing section 314 to cancel the printing operation(STEP S53). The job control determining section 903 displays a messageindicating cancellation of the job on an operation panel (STEP S54). Thejob control determining section 903 then terminates this operation.

The image forming apparatus according to the second exemplary embodimentcan determine whether to permit a printing operation according to anadministrator's setting without canceling the printing operationunconditionally even if the double-embedding possibly occurs. Morespecifically, when digital data is embedded doubly in a copy job, adouble-embedding operation can be suppressed while adjusting tradeoffbetween trackability and job output by switching contents of theprinting operation according to the setting “IGNORE” or “CANCEL”.

Third Exemplary Embodiment

Since configurations of an image forming apparatus and a networkprinting system according to a third exemplary embodiment of the presentinvention are the same as those of the first exemplary embodiment, adescription thereof is omitted by using the same numerals.

[Operation of Job Control Determining Section (Pattern 3)]

In the second exemplary embodiment, “IGNORE” for invalidating anembedding setting and “CANCEL” for canceling a job can be set accordingto an administrator's setting when double-embedding of additionalsecurity information possibly occurs. In the third exemplary embodiment,a description will be given for a case where a content of additionalsecurity information previously embedded in a copy target document iscompared with that of additional security information to be embedded andpermission or prohibition of a printing operation is decided accordingto the comparison result.

FIGS. 42 and 43 are flowcharts showing a procedure of an operationperformed by a job control determining section 903 when permission orprohibition of a printing operation is decided according to a result ofcomparison of contents of additional security information according tothe third exemplary embodiment.

First, an administrator's setting regarding permission or prohibition ofa printing operation when additional security information is doublyembedded will be described. FIG. 44 is a GUI showing a double-embeddingprevention setting dialog 4001 displayed in response to pressing of adouble-embedding prevention button 3305 on an administrator settingdialog (see FIG. 15). Radio buttons 4002 allow one of an option“DETERMINE AFTER COMPARING EMBEDDED INFORMATION” and an option “CANCEL”for canceling the printing operation as in the case of FIG. 36 to beselected when double-embedding occurs. Regarding “DETERMINE AFTERCOMPARING EMBEDDED INFORMATION”, a content of additional securityinformation previously embedded in a copy target document is comparedwith that of additional security information to be embedded. If thecontents match completely or partially as a result of comparison, theprinting operation is performed after invalidating theadditional-security-information embedding setting.

In the comparison of the embedded information, additional securityinformation previously embedded in a copy target document is comparedwith copy prohibition information set in FIG. 12 and trackinginformation set in FIG. 13 to be embedded. In the case ofdouble-embedding, the printing operation can be performed afterinvalidating the additional-security-information embedding setting onlywhen the contents of the copy prohibition information completely matchand user names of the tracking information match.

According to the administrator's setting of the double-embeddingprevention button 3305 (see FIG. 44), contents of the additionalsecurity information are compared at the time of embedding of furtheradditional security information in a document 3403 previously includingembedded additional security information. An operation performed by thejob control determining section 903 to invalidate the embedding settingor to cancel the job according to the comparison result will bedescribed.

Referring to FIGS. 42 and 43, since processing of STEPs S61 to S79 isthe same as that of STEPs S31 to S49 shown in FIGS. 38 and 39, adescription thereof is omitted.

If a flag LVBC_FLAG indicates TRUE at STEP S77, the job controldetermining section 903 instructs an image processing section 905 toinvalidate an additional-security-information embedding setting (STEPS80). The job control determining section 903 determines theadministrator's setting of the double-embedding prevention button 3305(STEP S81). If the double-embedding prevention button 3305 is set to“DETERMINE AFTER COMPARING EMBEDDED INFORMATION”, the job controldetermining section 903 extracts a second area when the second area hasnot been extracted (STEP S82). The job control determining section 903compares a content of additional security information previouslyembedded in a copy target document with a content of additional securityinformation to be embedded (STEP S83). The operation performed by thejob control determining section 903 corresponds to an operation of amatching determining unit. If the contents match, the job controldetermining section 903 instructs a printing section 314 to print a copytarget document (STEP S84). The job control determining section 903returns the process to STEP S76.

On the other hand, if the contents of the additional securityinformation do not match at STEP S83, the job control determiningsection 903 instructs the printing section 314 to cancel the printingoperation (STEP S85). Furthermore, the job control determining section903 displays a message indicating cancellation of the job on anoperation panel (STEP S86). The job control determining section 903 thenterminates this operation.

In addition, if the double-embedding prevention button 3305 is set to“CANCEL” at STEP S81, the job control determining section 903 instructsthe printing section 314 to cancel the printing operation as in the caseof the double-embedding operation shown in FIG. 36 (STEP S87).Furthermore, the job control determining section 903 displays a messageindicating cancellation of a job on an operation panel (STEP S88). Thejob control determining section 903 then terminates this operation.

The image forming apparatus according to the third exemplary embodimentcompares a content of additional security information previouslyembedded in a copy target document and a content of additional securityinformation to be embedded and can determine whether to permit orprohibit a printing operation according to the comparison result. Morespecifically, an operation of doubly embedding digital data can besuppressed by switching kinds of the printing operation according to aresult of comparison of embedded digital data with digital data to beembedded in a copy job.

In the above-described first, second, and third exemplary embodiments, acopy job using an image scanned by the image scanning section 901 as acopy target image has been described. In fourth, fifth, and sixthexemplary embodiments to be described below, a print job will bedescribed. In the print job, an image forming apparatus further embedsadditional security information in an image including additionalsecurity information embedded by a client PC, whereby double-embeddingis caused (see FIG. 35B).

Fourth Exemplary Embodiment

An operation performed when both of a client PC and an image formingapparatus embed additional security information will now be described.Since configurations of an image forming apparatus and a networkprinting system according to a fourth exemplary embodiment of thepresent invention are the same as those of the first exemplaryembodiment, a description thereof is omitted by using the same numerals.

[Double-Embedding of Additional Security Information in Print Job]

FIG. 45 is a diagram showing a functional configuration of a client PC111 and an image forming apparatus 131 when a copy restriction operationaccording to the fourth exemplary embodiment is performed. In thisnetwork printing system, the image forming apparatus 131 can furtherembed additional security information in an image including additionalsecurity information embedded by the client PC 111. A configuration ofeach section of the client PC 111 is the same as that shown in FIG. 3.

The client PC 111 combines print data and additional securityinformation according to a result of a user operation on a securitysetting dialog (see FIG. 5) and sends the print data to the imageforming apparatus 131. At this time, the client PC 111 sends informationregarding a kind of the combined additional security information to theimage forming apparatus 131 in addition to the print data.

On the other hand, a configuration of the image forming apparatus 131that receives the print data is substantially the same as those shown inFIGS. 16 and 41. Referring to FIG. 45, a data receiving section 311, adata analyzing section 312, and an image generating section 313 areprovided instead of an image scanning section 901. This configurationallows the image forming apparatus to further embed additional securityinformation in the additional-security-information containing printdata.

In addition, a line 911 extending from a job control determining section903 to an image processing section 905 is only used in “an operation ofthe job control determining section in a print job (pattern 2)” and “anoperation of the job control determining section in a print job (pattern3)” to be described later. As in the case of FIG. 41, the imageprocessing section 905 controls the image processing section 905 to ornot to perform an information embedding operation according to adetermination result of the job control determining section 903. Inother case (an operation of the job control determining section in aprint job (pattern 1)), the image processing section 905 embedsinformation in print data according to anadditional-security-information embedding setting regardless of thedetermination result of the job control determining section 903.

[Operation of Job Control Determining Section in Print Job (Pattern 1)]

FIG. 46 is a flowchart showing a procedure of an operation of the jobcontrol determining section 903 in a print job. The job controldetermining section 903 waits for a data receiving section 311 tocomplete reception of print data (STEP S91). After the completion of thereception of the print data, the job control determining section 903determines whether additional security information is embedded in theprint data (STEP S92).

If the information is not embedded, the job control determining section903 sets a flag LVBC_FLAG to FALSE (STEP S94). On the other hand, if theinformation is embedded, the job control determining section 903 setsthe flag LVBC_FLAG to TRUE (STEP S93).

After STEP S93 and S94, the job control determining section 903determines whether a compulsory information embedding setting, i.e., acompulsory information embedding setting 3304, is selected on anadministrator setting dialog (see FIG. 15) (STEP S95).

If the compulsory information embedding setting is not selected, the jobcontrol determining section 903 instructs the printing section 314 toprint the print data (STEP S96). In the processing at STEP S96, theprint instruction can be issued since theadditional-security-information embedding setting is not selected atSTEP S95 regardless of whether the additional security information haspreviously been embedded in the printed data.

On the other hand, if the additional-security-information embeddingsetting is determined to exist at STEP S95, the job control determiningsection 903 determines whether additional security information haspreviously embedded in the print data based on the value of the flagLVBC_FLAG (STEP S98). If the flag LVBC_FLAG indicates FALSE, theadditional security information has not been embedded. Thus, the jobcontrol determining section 903 instructs the printing section 314 toprint the print data including the additional security informationembedded by the image processing section 905 (STEP S99).

Since the additional security information is not embedded in the printdata, the instruction for printing the print data including theadditional security information embedded by the image processing section905 can be issued in the processing of STEP S99.

After STEPS S96 and S99, the job control determining section 903determines whether following print data exists (STEP S97). If thefollowing print data exists, the job control determining section 903returns the process to STEP S91 and waits for reception of the followingprint data to be completed. On the other hand, if the following printdata does not exist, the job control determining section 903 terminatesthis operation.

On the other hand, if the flag LVBC_FLAG is determined to be TRUE atSTEP S98 and the additional security information has previously beenembedded in the print data, further embedding of additional securityinformation means double-embedding and this has to be prohibited. Thejob control determining section 903 instructs the printing section 314to cancel printing of the print data including the additional securityinformation embedded by the image processing section 905 (STEP S100).The job control determining section 903 displays a message indicatingcancellation of the job on an operation panel (STEP S101).

The image forming apparatus according to the fourth exemplary embodimentcan suppress embedding of new additional security information in printdata previously including embedded additional security information. Morespecifically, when double-embedding of digital data occurs in a printjob, the double-embedding operation can be suppressed by canceling thejob. This allows a printing operation to be performed without destroyingadditional security information and convenience of a user improves.

Fifth Exemplary Embodiment

Since configurations of an image forming apparatus and a networkprinting system according to a fifth exemplary embodiment of the presentinvention are the same as those of the first exemplary embodiment, adescription thereof is omitted by using the same numerals.

[Operation of Job Control Determining Section in Print Job (Pattern 2)]

In the fourth exemplary embodiment, a printing operation is cancelledwhen double-embedding of additional security information possiblyoccurs. In the fifth exemplary embodiment, a description will be givenfor a case where permission or prohibition of a printing operation isdecided according to an administrator's setting instead of canceling theprinting operation unconditionally when the double-embedding possiblyoccurs. Here, the administrator's setting for permitting or prohibitingthe printing operation when the additional security information isembedded doubly is the same as that described using FIG. 40.

FIGS. 47 and 48 are flowcharts illustrating a procedure of an operationperformed by the job control determining section 903 according to anadministrator's setting in accordance with the fifth exemplaryembodiment. In this operation, whether to invalidate embedding ofadditional security information in the print data 3503 previouslyincluding embedded additional security information or to cancel a job iscontrolled according to the administrator's setting of thedouble-embedding prevention button 3305.

Since processing of STEPs S111 to S118 is the same as that of STEPs S91to S98 shown in FIG. 46, a description thereof is omitted.

If a flag LVBC_FLAG is determined to be FALSE at STEP S118, the jobcontrol determining section 903 instructs an image processing section905 to embed additional security information since the additionalsecurity information has not been embedded (STEP S119). The job controldetermining section 903 instructs a printing section 314 to print theprint data (STEP S120).

On the other hand, if the flag LVBC_FLAG is determined to be TRUE atSTEP S118, the job control determining section 903 instructs the imageprocessing section 905 to invalidate the additional-security-informationembedding setting (STEP S121). The job control determining section 903determines the administrator's setting of the double-embeddingprevention button 3305 (STEP S122).

If the double-embedding prevention button 3305 is set to “IGNORE”, thejob control determining section 903 instructs the printing section 314to print the print data (STEP S123). The print instruction issued atSTEP S123 is an instruction for performing the printing operationwithout embedding the additional security information according to theadministrator's setting when the additional security information isembedded doubly. The job control determining section 903 then advancesthe process to STEP S117.

On the other hand, if the double-embedding prevention button 3305 is setto “CANCEL” at STEP S122, the job control determining section 903instructs the printing section 314 to cancel the printing operation asin the case of the double-embedding operation shown in FIG. 46 (STEPS124). The job control determining section 903 displays a messageindicating cancellation of the job on an operation panel (STEP S125).The job control determining section 903 then terminates this operation.

The image forming apparatus according to the fifth exemplary embodimentcan decide permission or prohibition of a printing operation accordingto an administrator's setting without canceling the printing operationunconditionally even if double-embedding possibly occurs. Morespecifically, when digital data is embedded doubly in a print job, adouble-embedding operation can be suppressed while adjusting tradeoffbetween trackability and job output by switching contents of theprinting operation according to the setting “IGNORE” or “CANCEL”.

Sixth Exemplary Embodiment

Since configurations of an image forming apparatus and a networkprinting system according to a sixth exemplary embodiment of the presentinvention are the same as those of the first exemplary embodiment, adescription thereof is omitted by using the same numerals.

[Operation of Job Control Determining Section in Print Job (Pattern 3)]

In the fifth exemplary embodiment, “IGNORE” for invalidating anembedding setting and “CANCEL” for canceling a job can be set accordingto an administrator's setting at the time of double-embedding ofadditional security information. In the sixth exemplary embodiment, adescription will be given for a case where a content of additionalsecurity information previously embedded in print data is compared withthat of additional security information to be embedded and permission orprohibition of a printing operation is decided according to thecomparison result. Since the administrator's setting for permitting orprohibiting the print operation when the additional security informationis embedded doubly is the same as that described using FIG. 44, adescription thereof is omitted here.

FIGS. 49 and 50 are flowchart illustrating a procedure of an operationperformed by a job control determining section 903 according to a resultof comparison of contents of additional security information. Here,contents of additional security information are compared regardingfurther embedding of additional security information in the print data3503 previously including embedded additional security informationaccording to an administrator's setting of a double-embedding preventionbutton 3305. Whether to invalidate an embedding setting or to cancel ajob is then decided. Meanwhile, since processing at STEPs S131 to S140is the same as that at STEPs S111 to S120 shown in FIGS. 47 and 48, adescription thereof is omitted.

If a flag LVBC_FLAG is determined to be TRUE at STEP S138, the jobcontrol determining section 903 instructs an image processing section905 to invalidate an additional-security-information embedding setting(STEP S141). The job control determining section 903 determines theadministrator's setting of the double-embedding prevention button 3305(STEP S142).

If the double-embedding prevention button 3305 is set to “DETERMINEAFTER COMPARING EMBEDDED INFORMATION”, the job control determiningsection 903 performs the following operation. In this case, the jobcontrol determining section 903 compares a content of additionalsecurity information previously embedded in print data with a content ofadditional security information to be embedded (STEP S143).

If the contents match, the job control determining section 903 instructsa printing section 314 to print the print data (STEP S144). On the otherhand, if the contents of the additional security information do notmatch at STEP S143, the job control determining section 903 instructsthe printing section 314 to cancel the printing operation (STEP S145).The job control determining section 903 displays a message indicatingcancellation of the job on an operation panel (STEP S146). The jobcontrol determining section 903 then terminates this operation.

In addition, if the double-embedding prevention button 3305 is set to“CANCEL” at STEP S142, the job control determining section 903 instructsthe printing section 314 to cancel the printing operation as in the caseof the double-embedding operation shown in FIG. 46 (STEP S147). The jobcontrol determining section 903 displays a message indicatingcancellation of a job on an operation panel (STEP S148). The job controldetermining section 903 then terminates this operation.

The image forming apparatus according to the sixth exemplary embodimentcompares a content of additional security information previouslyembedded in print data and a content of additional security informationto be embedded and can determine whether to permit a printing operationaccording to the comparison result. More specifically, an operation ofdoubly embedding digital data can be suppressed by switching kinds ofthe printing operation according to a result of comparison of embeddeddigital data with digital data to be embedded in a print job.

The present invention is not limited to the configurations of theabove-described exemplary embodiments and can be applied to any givenconfiguration as long as functions disclosed by Claims or functions ofthe configurations of the exemplary embodiments can be achieved.

For example, although LVBC is used as a coded image of copy restrictioninformation and tracking information embedded in a background image inthe exemplary embodiments, the coded image is not limited to the LVBCand may be one-dimensional barcode, two-dimensional barcode such as QRCode®, or digital watermark.

In addition, flowcharts shown in each exemplary embodiment may beexecuted by a system constituted by a plurality of devices or anapparatus constituted by a single device. In addition, the image formingapparatus includes a facsimile apparatus having a printing function anda multifunctional printer (MFP) having a printing function, a copyfunction, and a scanner function as well as a printing apparatus. Inaddition, the printing method is not limited to the electrophotographicmethod and various printing methods, such as an inkjet method, a thermaltransfer method, a thermal method, an electrostatic method, and anelectrosensitive method, can be employed.

Additionally, an object of the present invention is achieved byexecuting the following processing. More specifically, a storage mediumhaving a software program code for realizing the functions of theabove-described exemplary embodiments recoded thereon is supplied to thesystem or the apparatus and a computer (or a CPU and an MPU) included inthe system or the apparatus reads out the program code stored on thestorage medium.

In this case, the program code read out from the storage medium realizesthe functions of the above-described exemplary embodiments and theprogram code and the storage medium having the program code recordedthereon constitute the present invention.

Types of the storage medium used for supplying the program code include,for example, a Floppy Disc®, a hard disk, a magneto-optical disc, anoptical disc such as a CD-ROM, a CD-R, a CD-RW, and a DVD-ROM, aDVD-RAM, a DVD-RW, and a DVD+RW, a magnetic tape, a nonvolatile memorycard, and a ROM. In addition, the program code may be downloaded via anetwork.

In addition, a case where a computer executes the read out program codeto realize the functions of the above-described exemplary embodiments isincluded in the present invention. Additionally, a case where anoperating system (OS) operating in the computer executes part of or allof actual processing based on instructions of the program code and thefunctions of the above-described exemplary embodiments are realized bythe processing is also included in the present invention.

Furthermore, a case where the functions of the above-described exemplaryembodiments are realized by the following processing is also included inthe present invention. More specifically, a program code read out from astorage medium is written in a memory included in a function expansionboard inserted into a computer or a function expansion unit connected tothe computer. A CPU or the like included in the function expansion boardor the function expansion unit executes part of or all of actualprocessing based on instructions of the program code.

While the present invention has been described with reference toexemplary embodiments, it is to be understood that the invention is notlimited to the disclosed exemplary embodiments. The scope of thefollowing claims is to be accorded the broadest interpretation so as toencompass all modifications and equivalent structures and functions.

What is claimed is:
 1. A copier comprising: a reading unit configured toread a document including an image indicating that copying the documentis permitted subject to an input of authentication information to obtainan image; a printing unit configured to print the obtained image toobtain a copied document; a setting unit configured to set a setting foradding an image indicating that copying the copied document isprohibited; and a controlling unit configured to control the printingunit so that in a case where the setting is not set, the obtained imageis printed subject to an input of the authentication information, and ina case where the setting is set, the obtained image is not printed. 2.An apparatus for executing a copy operation, comprising: a reading unitconfigured to read a document including an image indicating that copyingthe document is permitted subject to an input of authenticationinformation to obtain an image; a printing unit configured to print theobtained image to obtain a copied document; a setting unit configured toset a setting for adding an image indicating that copying the copieddocument is prohibited; and a controlling unit configured to control theprinting unit so that in a case where the setting is not set, theobtained image is printed subject to an input of the authenticationinformation, and in a case where the setting is set, the obtained imageis printed subject to an input of the authentication information withoutadding the image indicating that copying the copied document isprohibited to the obtained image.
 3. A method for copying a document,comprising: reading a document including an image indicating thatcopying the document is permitted subject to an input of authenticationinformation to obtain an image via a reading unit; printing the obtainedimage to obtain a copied document via a printing unit; setting a settingfor adding an image indicating that copying the copied document isprohibited to the obtained image via a setting unit; and controlling theprinting unit via a controlling unit so that in a case where the settingis not set, the obtained image is printed subject to an input of theauthentication information, and in a case where the setting is set, theobtained image is not printed.
 4. A non-transitory computer-readablestorage medium that stores a program causing an apparatus to execute acopy operation method as claimed in claim
 3. 5. A method for copying adocument, comprising: reading a document including an image indicatingthat copying the document is permitted subject to an input ofauthentication information to obtain an image via a reading unit;printing the obtained image to obtain a copied document via a printingunit; setting a setting for adding an image indicating that copying thecopied document is prohibited to the obtained image via a setting unit;and controlling the printing unit via a controlling unit so that in acase where the setting is not set, the obtained image is printed subjectto an input of the authentication information, and in a case where thesetting is set, the obtained image is printed subject to an input of theauthentication information without adding the image indicating thatcopying the copied document is prohibited to the obtained image.
 6. Anon-transitory computer-readable storage medium that stores a programcausing an apparatus to execute a copy operation method as claimed inclaim 5.